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Abstract 

We develop the theory of partial satisfaction relations for structures that may 
be proper classes and define a satisfaction predicate (|=*) appropriate to such 
structures. We indicate the utility of this theory as a framework for the devel- 
opment of the metatheory of first-order predicate logic and set theory, and we 
use it to prove that for any recursively enumerable extension of ZF there is 
a finitely axiomatizablc extension 0' of GB that is a conservative extension of 
O. We also prove a conservative extension result that justifies the use of |=* to 
characterize ground models for forcing constructions. 
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1 Introduction 

In discussions of the theory of sets it is a common practice to use the termi- 
nology of satisfaction and models informally with reference to structures that 
are proper classes. An "inner model" , for example, is informally defined as a 
proper transitive class M such that (M; £) "satisfies" ZF (Zermelo-Fraenkel set 
theory). In the context of a pure set theory, such as ZF, any such reference is 
necessarily informal for two reasons: 

1. Proper classes do not exist, and can only be referred to as predicates 
applicable to sets. 

2. ZF is not finitely axiomatizable, so one cannot say that M is an inner 
model by means of a single sentence relativized to M . 

For example, in the context of ZF the statement 

(1.1) L is a model of ZFC 

is understood to stand for the set of all sentences 9 L , where 9 is an axiom of 
ZFC, and 9 L is the sentence 9 with all quantified variables are restricted to 
constructible sets. In the context of a class theory such as the von Neumann- 
Bernays-Godel, or Godel-Bernays, theory GB, one can demonstrate the existence 
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of the class L of constructible sets, and one might expect to be able to formulate 

(1.1) as a single sentence 

(1.2) L \= ZFC, 

but the interpretation of such a sentence is problematic, inasmuch as it is not 
possible to prove — in a conservative 1 class theory such as GB — that there exists 
a satisfaction relation for L (or for proper class structures in general). 

In this article, we examine issues related to the existence and use of partial 
satisfaction relations for proper class structures in the context of conservative 
class theories with and without the Infinity axiom. In particular, we propose a 
definition of satisfaction for proper class structures that is weak enough that 

(1.2) , for example, is a theorem of GB, but strong enough that (1.2) implies 6 
for every axiom of ZF. For the sake of emphasis, in this article we denote 
this universal satisfaction predicate by '[=*', but there is no reason its definition 
(2.10) could not be taken as the primary definition of '(='. By means of |=*, 
the conventional informal use of proper class models may be rendered formally 
correct with minimal modifications to standard practice. Such notions as ele- 
mentary substructure and elementary embedding of proper class structures are 
formalizablc in GB in a similar way, as are the notions of forcing relation and 
boolean valuation, all of which are subject to the same limitations as satisfaction 
in conventional treatments. 

Section 2 is devoted to a brief explication of the notion of satisfaction for 
proper class structures and related ideas. These are quite straightforward, and 
wc do not suppose that they are entirely new; however, we have not found any 
systematic treatment of them in the existing literature. In particular, we have 
not found a definition of |=* or a discussion of its use in set theory. We therefore 
state the principal theorems and sketch their (straightforward) proofs. We do 
this primarily in the context of the theories S and C, which we define respectively 
to be ZF and GB with the Infinity axiom omitted. Note that these theories do 
not contain — ■ Infinity, so they may be extended to ZF and GB, respectively, 
by the addition of Infinity. S + -> Infinity is — for all practical purposes — Peano 
arithmetic. The use of satisfaction relations for proper classes in C permits an 
essentially finitary, but nonetheless efficient, development of the theory of first- 
order predicate logic. 2 The book Foundations of Mathematics: A Generalist's 
Guide [Id] employs these ideas throughout and demonstrates the clarity and 

J By 'conservative' we mean that the class comprehension axiom schema employs only 
formulas without bound class variables. 

2 We do not present this development here beyond what is necessary for the purposes of this 
article; but the following example is worthy of mention. Consider Godel's first incompleteness 
theorem, which presents a sentence a that says, in effect, that a is not provable in S (which we 
use here for convenience instead of the more customary Peano arithmetic), and states that a 
is not a theorem of S, even though it is (by virtue of that fact) true. This is ordinarily proved 
in a metatheory other than S, which is often not explicitly characterized, but may generally 
be considered to be ZF. Then it is stated that the theorem and proof could be given in S with 
the additional hypothesis that S is consistent. Therefore, assuming ConS, SFConS, which is 
Godel's second incompleteness theorem. An actual proof of the first theorem in S is generally 
considered such an ungainly thing that it is not usually given in any detail, despite the fact 
that its existence is critical to the proof of the second theorem. This defect can be remedied 
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precision they bring to the explication of the foundations of mathematics, from 
elementary logic to advanced set theory. 

In Section 3 we prove a generalization of the well known theorem that GB is 
a finitely axiomatizable conservative extension of ZF. This is Theorem 3.1. The 
universal satisfaction predicate is not involved in the statement of this result, 
but (a slight variation of) it is intrinsic to the proof. 

In Section 4 we discuss the implications of the use of \=* for the correlation 
between the forcing relation within a transitive model M of ZF, and the satis- 
faction relation in a generic extension M[G]. If M is a countable set, of course, 
p lh p 4>(xq, . . . , Xn-i) iff for every M-generic filter G on a partial order P £ ill, if 
p £ G then M[G] \= 4>[xq, . . . , a^L-J. Essentially the same correlation holds in 
the general case (when M is an uncountable set or a proper class), but it must 
be stated without reference to generic filters. 

This is the method of "arguing in a generic extension" , which conventionally 
goes as follows. The theory (Definition 4.1) — which includes ZF and also says 
that the universe is V[G], where V is an inner model of ZF, and G is a V-gencric 
filter on P — holds in M[G] whenever G is an M-generic filter on P £ M, and V 
is interpreted as M. "Arguing in a generic extension" means proving something 
in to demonstrate that something is forced. 

If we adopt |=*, it is natural to use the theory 0' defined in (4.7), which 
differs from in that it includes GB and implements the assumption that V is an 
inner model of ZF as the single sentence r V |=* ZF n , rather than all sentences 
r v_1 , where 8 is an axiom of ZF. To justify the inference that something is 
forced from the existence of a proof in 0', we show that 0' is a conservative 
extension of 0. This is Theorem 4.9. 

In Section 5, for the sake of completeness, we define a universal forcing 
relation and universal boolean valuation function that are analogous to the 
universal satisfaction relation, by means of which the conventional informal use 
of forcing relations and boolean valuations for proper classes may be rendered 
formally correct — again, with minimal modifications to standard practice. 

2 The role of satisfaction for proper classes in 
set theory and its metatheory 

2.1 Some useful conventions 

Recall the definition of S and C as ZF and GB with Infinity omitted. We regard 
C (like GB) as a theory with two sorts of individuals: sets and classes. All 

sets are classes. A class is proper <£^4» it is not a set. Let c be the signature 
(similarity type) of this theory, and let s be this signature with the class sort 
omitted. Thus, s is the signature of S (and ZF). Let C s and C c be the languages 

by proving the first theorem in C, rather than ZF, which is not any harder, and is arguably 
more natural. Then we can invoke the well known result that C is a conservative extension of 
S (2.2) to conclude rigorously that a proof of the first theorem in S exists, without giving it 
in detail. 
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appropriate to the above signatures. Given a theory 0, i.e., a class of sentences, 

let d = its deductive closure. 
It is well known that 

(2.1) C is finitely axiomatizablc, 
whereas S is not. 3 

(2.2) C is a conservative extension of S in the sense that C PI C s = S. 

(2.2) has a simple infinitary proof (e.g., a ZF-proof), and a considerably more 
involved finitary proof, (e.g., an S-proof). Given (2.2), it is appropriate to regard 
C as a finitary theory, like S. 

The discussion that follows, particularly the proofs of Theorems 3.1 and 4.9, 
involves a sufficiently intricate interplay of meta- and object theories that it 
is helpful to use notation for linguistic expressions that distinguishes use and 
mention more particularly than is often done; although the reader is forewarned 
that we do not always maintain the highest standard in this regard — a judicious 
ambiguity sometimes best serves the cause of clarity. Unless otherwise noted, 
the following discussion takes place in the context of C. Thus, infinite sets may 
not exist. 

Given a text string that represents an expression e in an object language, 
if we flank it with corner quotes, ... , we create a string that represents a 
metalanguage name v for e. We use boldface versions of standard typographic 
symbols for syntactical operations to denote various expression-building opera- 
tions in any language. Thus, for example, <f>/\ip is the conjunction of formulas 
<p and ijj in any language. We may extend this to some common predicate and 
operation symbols, such as those for membership and identity. Thus, if it = x , 
v = r y^, and w = r z n , then uGv Av Ew— >u&w is r ifx G y and y G z then 
x G z . 

Substitution of terms for variables in expressions is indicated with round 
brackets. Suppose e is an expression, and Vq, . . . , u n _i are in Freee, the set of 
free variables of e. Suppose To, ... , r„_i are terms. e(^° ' ' ' ^"~*) is the expres- 
sion that results from the indicated substitutions. When it is not necessary to 
indicate the variables, 'e(ro, . . . , r n _i)' may be used. It is often convenient to use 

3 This is better known for GB and ZF. The finite axiomatization of GB as originally given 
by Bernays[l] yields C if Infinity is omitted. A proof that ZF is not finitely axiomatizable may 
be given in S + ConZF as an easy application of the reflection theorem schema of ZF, i.e. of 
the theorem of S that every instance of the reflection schema is a theorem of ZF. From this 
it follows that S is not finitely axiomatizable (otherwise by adding Infinity we would have a 
finite axiomatization of ZF); however, this gives the result as a theorem of S + ConZF . In 
what may be viewed as a clever adaptation of the reflection method, Ryll-Nardzewski gave a 
proof in ZF that S is not finitely axiomatizablc [6]. Ryll-Nardzcwski's argument is intrinsically 
infinitary, as it uses the satisfaction relation for (V u ; £). (In fact, the statement of his theorem 
is intrinsically infinitary, as it applies to arbitrary true extensions of S, i.e., theories D S 
such that \= s ©, where S is the full satisfaction relation for {Vui', G).) By way of illustrating 
some of the ideas presented in this article, we show in the proof of Theorem 2.25 how Ryll- 
Nardzcwski's argument may be (easily) adapted to provide a proof in S + Con S that S is not 
finitely axiomatizable. 
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a similar notation where e is indicated using the corner-quote convention. For 
example, suppose </>, ip, and 9 are respectively x G y , y G z , and a; 6 z . 
Then 

r if <j) and V then n (2.3) 

is 

r if a; G y and j/ G z then a; G z n , 
the result of substituting the metalanguage terms 

x G y , y G z , xGz 

in the metalanguage term 

r if and then n , 

where the underscores indicate variables (ranging over formulas) that we do not 
need to name, as they are always substituted in the indicated fashion. When we 
indicate such a substitution "in line", as in (2.3), we give the brackets a lighter 
tone than the surrounding text, so as to render them relatively unobtrusive and 
to distinguish them from round brackets used as grouping indicators. 

A similar convention applies to the use of square brackets to indicate assign- 
ments of individuals in a structure to variables in an expression for the purpose 
of valuation (or satisfaction in the case of formulas). Our first use of this is in 
(3.6). Note that (3.6.1) is a conventional use of square brackets to create the 
statement that the c-formula D is satisfied at the indicated values, viz., 9 and y, 
for its free variables. (3.6.2) is the statement that the formula indicated by the 
corner-quoted text, with implicit variables in place of the insertions, is satisfied 
when those variables are assigned the indicated values, viz., S and n. 

For convenience we suppose that s and c have two binary predicate symbols, 
one to denote membership and one to denote identity. The extended signatures 
s' and c' have, in addition, a nulary operation symbol (i.e., a constant) to denote 
the empty set 0, and a binary operation symbol to denote the add operation: 
x^y = x U {y}. 

'HF' is a defined predicate in S characterizing the hereditarily finite sets. 
In C, 'HF' may be used this way, and also as a constant denoting the class of 
hereditarily finite sets. Note that in this setting, HF = V w . For each x such that 
HFa;, let x be a specific s'-term (a composition of and ^ ) whose value is 
x, chosen by some fixed recursive procedure. Call x the canonical name of x. 

We will use an informal representation of structures, such that 

(D , D\, . . . ; Xq, Xi, . . . ) 

is a structure with domains (sorts) Do, Di, ■ ■ ■', and predicates and operations 

Xq, Xi, We regard (Do, D\, . . . ; Xq, X\, . . .) as encoding D , . . . , Xq, ... in 

a way that is applicable to proper classes, as well as sets. 

We suppose that for any signature p, the expression-building operations for 
the corresponding language C p are uniformly defined in terms of and ^ in 
such a way that the rank of any expression is greater than the rank of any of 
its subexpressions. If p G HF then C p C HF. 
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2.2 Partial satisfaction relations 

Suppose e is an expression. Then Free e d = the set of free variables of e. A is an 
©-assignment for e <:=$■ A is a finite function into | © | such that Free e C Dom A. 
The value of an expression e at an ©-assignment A for e is an element of © if e 
is a term and is a member of 2, i.e., {0, 1}, if e is a formula, with 1 corresponding 
to 'true' and to 'false'. 

Suppose 4> is a class of p-expressions, <£> = the class of subexpressions of $. 
We regard an expression as a subexpression of itself, so <& 3 $. Suppose 6 is a 
p-structure. A $- valuation function for 6 is a function F such that 

1. DomF consists of all (e, A) such that e£$ and A is an ©-assignment for 

e; 

2. F(e, A) is in |©| if e is a term and in 2 if e is a formula; 

3. F satisfies the usual recursive definition of valuation. 

F is a partial valuation function for © <=> F is a ^-valuation for some class 
$ of p-exprcssions. 

Suppose © is a p-structurc. It is straightforward to show in C that partial 
valuations for © agree on their common domain. 

The following theorem is essentially trivial, but we take the time to state it 
and sketch the proof to point out where the corresponding proof for the class F p 
of all p-formulas fails when © is a proper class. Here, as elsewhere, we indicate 
the theory within which a theorem is stated and proved; in this case it is C. We 
do the same for definitions. 

Theorem 2.4. [C] Suppose & is a p-structure. Then there is a unique TP- 
valuation function for 6, where F p is the class of p-terms. 

Proof. Suppose r is a term and A is an assignment for r. F is a (r, A)-valuation 

def 

function for 6 F satisfies the usual definition of valuation function for pairs 
(t',A), where r' is a subexpression of r. Note that Freer' C Free-r, so A is 
an assignment for r'. A (r, A)-valuation function is finite and is therefore a 
set. We now show that for any term r and assignment A for r, there is a 
unique (t, A)-valuation function, by supposing toward a contradiction that the 
class C of terms r 1 with Freer' C Dom A for which there is no (r', A)-valuation 
function, is nonempty. The definition of C employs only set-quantification, so C 
exists. Let tq G C be of minimal complexity. One easily derives a contradiction. 

Now we can define the value of r at A as the value assigned to r by the 
unique (t, A)-valuation function. Again, the quantification over (r, yl)-valuation 
functions is set-quantification, so the valuation function exists. □ 

The same argument works for quantifier-free formulas </>, because in this 
case, an assignment for <p is also an assignment for any subexpression of 0; 
but this is not the case if (j> contains quantification. For example, if <f> — 3v ip, 
the definition of the value of <j) at A involves the values of ip at assignments 
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A U {(v, a)} for ip, where a ranges over @|. Thus, in defining the value of <p at 
A, it is not enough to quantify over (<f>, /l}-valuation functions as in the proof 
of Theorem 2.4; instead, we must quantify over {^j-valuation functions for tp 
a subformula of <f>. These are proper classes if © is a proper class, so we have 
no justification in C for concluding that a class exists such as C in the proof of 
Theorem 2.4. 

It is conventional to speak of valuation of formulas in terms of satisfaction. 
Given a valuation function F, the corresponding satisfaction relation S is given 



We adapt the usual symbol for satisfaction to the representation of partial sat- 
isfaction by letting |= s <p[A] = (<f>, A) G S when S is a {^-satisfaction relation 
for a structure ©, and A is an ©-assignment for <f>. The preceding discussion 
shows that we may not be able to prove in C the existence of a full satisfaction 
relation for a proper class structure. Indeed, it shows that we may not be able 
to prove the ostensibly weaker statement that for every formula <p there is a 
{0}-satisfaction relation. 

We do, however, have the following theorem. 

Theorem 2.5. [C] Suppose 6 is a p-structure, ip and ip' are p-formulas, and 
{ip}- and {ip'}-satisfaction relations exist for ©. Suppose <p is obtained from ip 
and/or ip' by a single formula-building operation: -i, V, A,— I, -f*, 3u,Vu. Then a 
{(p}-satisfaction relation exists. 

Proof. Straightforward. □ 

Definition 2.6. [C] Suppose p C HF and n £ oj. Let ^ f the set of p-formulas 
of rank < n, i.e., T p D V n . 

Note that since the expression-building operations are rank-increasing, = 
If p is HF, we may use the canonical naming convention to formulate the 
following theorem, which may be called a metatheorem, inasmuch as it states 
that an infinite collection of sentences are theorems of C. The theorem itself is 
formulated and proved in S. 

Theorem 2.7. [S] Suppose p is a signature and p is HF. Suppose n is a finite 
ordinal. Let p and n be the canonical names for p and n. Then C h for every 
p -structure & there exists a $ p ~ -satisfaction relation for (3 n . 

Proof. Let p be fixed. We proceed induction on the complexity of formulas 
using the fact that C proves Theorem 2.5. □ 

Definition 2.8. [C] Suppose © is a p-structure. 

1. 6 is weakly satisfactory <^l> for every p-formula <p> there exists a {</>}- 
satisfaction relation for ©, cquivalently, for every finite $ there is a 
satisfaction relation. 



by 



(<M) G S**F{<I>,A) = 1. 
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2. © is satisfactory -4=^ there exists a full satisfaction relation, i.e., an T p - 
satisfaction relation, for 6, where T p is the class of all p-formulas. 

Theorem 2.9. [C] Suppose & is a structure. If & is a set then © is satisfactory, 
i.e., the full satisfaction relation for © exists. 

Proof. Straightforward. □ 



2.3 The universal satisfaction predicate 

As noted above, the existence of satisfaction relations for proper class structures 
is problematic, and the following definition is useful in this context. 

Definition 2.10. [C] Suppose 6 is a p-structure. 

1. Suppose 4> is a p-formula, and A is an ©-assignment for (f>. Then © |=* <fi[A] 
4=4- for every {0}-satisfaction relation S for 6, |= s <f>[A]. 

2. Suppose is a p-theory (a class of p-sentences). © |=* -<=!> for every 
9 e 0, © h* s. 

We call \=* the universal satisfaction predicate. Note the use of universal, rather 
than existential, quantification over partial satisfaction relations in the definition 
of |=*. 

The following theorems are relevant. The first is the completeness theorem 
formulated in the essentially finitary theory C. 

Theorem 2.11. [C] Suppose is a consistent theory in a countable signature. 
Then there is a satisfactory structure © such that 6 |= 0. 

Proof. The Henkin construction of a model for a consistent theory proceeds 
by defining a complete consistent extension 0' of with witnesses, which are 
constants in an expanded signature s + . 6 is defined as the structure whose 
individuals are the s + -tcrms and whose predicates and operations are given by 
0'. 0' also gives the full satisfaction relation for 6. □ 

Theorem 2.12. [C] Suppose & is a weakly satisfactory p-structure, is a 
p-theory, a is a p-sentence, © \=* 0, and ©her. Then © \=* a. 

Proof. Suppose n is a proof of a from 0. Let $ be the set of formulas occurring 
in 7i", and let S be a ^-satisfaction relation for ©. Each premise 9 of tt is then a 
member of 0, so \= s 9. It is straightforward to show that \= s a, so © |=* a. □ 

Corollary 2.13. [C] Suppose & is a weakly satisfactory p-structure, is a 
p-theory, and © \=* 0. Then is consistent. 

Proof. Suppose toward a contradiction that h a A —> a for some p-sentence a. 
Then © |=* aA^a. Let 5 be a {a A -> cr}-satisfaction relation for ©. Then 
\= s a and |= s -i a, but the latter implies that ^= s a, a contradiction. □ 
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In this connection we note the following theorem. 

Theorem 2.14. [C] Suppose & is a p-structure and o~ is a p-validity, i.e., her. 
Then 6 |=* a. 

The proof is not quite as trivial as the theorem appears to be. To prove it 
in C, as opposed to GB, we use the existence of a deductive system for logic 
without identity that has the subformula property. For example, let LK be 
the logischer klassischer Kalkul of Gentzen, as described in [9, Ch. 1, §2], and 
let LK be the same system with the cut rule omitted. The latter has the 
subformula property, i.e., all formulas appearing in a proof of a sequent are 
(instances of) sub formulas of formulas appearing in the final sequent. By the 
cut- elimination theorem (Gentzen's Hauptsatz), any sequent derivable in LK is 
derivable in LK . 

To place this result in the proper perspective from the standpoint of C, 
we digress briefly. Consider a fixed language in a signature without identity. 
The completeness theorem for the sequent calculus is may be taken to be the 
following assertion: 

(2.15) If a sequent J = (T =>• A) is not derivable then there is a an interpre- 
tation that does not satisfy J, i.e., a structure © and an & -assignment A for 
J such that 6 ^ J [A], i.e., ©HA r [^] and © ^ V A [ A \- 

Here an interpretation is ordinarily understood to be a structure © and an 
©-assignment of all variables. 

Working in C, however, we must be more specific as to the meaning of 
'interpretation; Specific-ally, we define subvaluation as in [ , §2.5]. (Briefly, 
this weakens the notion of partial valuation so that — for example — we may 
assign the value true to <f> V ip without having assigned a value to both c/> and 
tp; it is enough to have assigned the value true to one of these, leaving the 
other unassigned; whereas in order to assign the value false to (f>V ?p we must 
have assigned false to both 4> and ip.) We define a J -interpretation to be a 
structure ©, an ©-assignment of the free variables of J, and an 6-subvaluation 
that assigns a value to each formula in J at the given assignment. The standard 
proof of (2.15) (e.g., the proof of Lemma 8.3 in [9]) yields the following: 

(2.16) If J is not LK~ -derivable then there is a J -interpretation that does 
not satisfy J. 

A straightforward modification of this method yields the following: 

(2.17) If J is not LK-derivaMe then there is a full interpretation that does 
not satisfy J. 

This is equivalent to the completeness theorem (2.11) stated above. 

The corresponding soundness theorems for LK and LK are respectively: 

(2.18) If J is LK -derivable then every J -interpretation satisfies J. 

(2.19) If J is LK-derivaWe then every full interpretation satisfies J. 
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Given Infinity, the distinction between J- and full interpretations is irrelevant, 
as we may restrict our attention to structures that are sets, so that any J- 
intcrpretation is uniquely extendible to a full interpretation. This yields the 
standard model-theoretic proof of the cut-elimination theorem: if J is LK- 
derivable then every full interpretation satisfies J, so every J-interprctation 
satisfies J, so J is LK~-dcrivablc. In C, of course, this proof of cut-elimination 
is not available, but there are effective proofs (e.g., the proof of Theorem 5.1 in 
[!.)]) that may be rendered in C, and this yields the following as a theorem of C: 

(2.20) A sequent J is LK -derivable iff J is hK.-dcrivablc iff every full 
interpretation satisfies J iff every J -interpretation satisfies J. 

The following finitary proof of Theorem 2.14, depending as it does on (2.20), is 
therefore another example of the value of the effective proof of cut-elimination. 

Proof of Theorem 2.14- Suppose p is a signature without identity, a is a p- 
sentence, a (i.e., the sequent =>{cr}) is LK-derivablc, and S is a {er}-satisfaction 
relation for 6. By (2.20), |= 5 a. If p is a signature with identity, a short addi- 
tional argument is necessary. □ 

Wc will be particularly concerned with satisfaction relations for (V; e), where 
V is the class of all sets. Any mention of V as a structure in this article refers to 
(V; E) or to an essentially equivalent structure with additional defined predicates 
or operations. 

Theorem 2.21. [S] Suppose n is a finite ordinal, and 9 E V n is an s-sentence. 
Then C h The $ s fi -satisfaction relation for V exists. Let S be this relation. 

Then 9 o ^ s r 9 n o h S ■ 

Proof. By induction on n, using Theorem 2.7. □ 
Theorem 2.22. [C] (V; e) h* S. 

Proof. For any individual axiom 9 E S, we can prove r (V; e) |=* r 9 directly. 
In fact, since Ch0, (2.21) informs us that Ch r (V; e) ^* r 9 ~ n . Note that 
the direct proof of r (V; e) ^* r 9 n_l uses 9 as a premise. Thus, for example, 
to prove that (V; €) |=* Pair we use the fact that pairs exist in V, arguing as 
follows: 

Suppose S is a {#}-satisfaction relation for V, where 

9 = Vu, u 3v\/w (w E v -o- w = itV w = u). 
To show that \= 9 we must show that 

Vx,x' eVBye VWz eV(^ sr z E y n o h 5 r z = x n V^ s r \z] = x' n ). 

To this end, suppose x,x' E V. Let y = {x,x'}. Then y is as desired. 

If 6 C S is an axiom schema, we cannot rely in this way on the fact that 
C h to show that (V; £) |=* 0, as our proof must be finite. As it happens, in 
these cases, it suffices to invoke a single corresponding axiom of C. 
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Suppose, for example, that 

9 = r Vy \/x 3x' Vz(z£x'hz£iA [ip)[z, y)) n 

is an instance of the Comprehension schema of S, where ip is an s-formula with 
two free variables. We must show that for every {6>}-satisfaction relation S for 
V, \= s 8. Suppose, therefore, that S is a {#}-satisfaction relation for V. We 
must show that 

VyVxBx'Vz ^ s r zei'oz£iA ip (z, y)~ l . 

Given y and x, let x' = {z £ x ip[z, y]}. Note that the existence of x' as 
a class follows from a single instance of the Comprehension schema of C (with 
parameters x, S, ip, z, y). That x' is a set follows from the Separation axiom that 
states that the intersection of a class with a set is a set. 

The Collection schema is handled similarly. □ 

Note that Theorem 2.14 does not permit us to drop the condition of weak 
satisfactoriness in Theorem 2.12. In particular, despite Theorem 2.22, we have 
the following. 

Theorem 2.23. [S] If S is consistent then CK r for every theorem a of S, 
(V;€) R <P. 

Proof. We will prove the contrapositive. Suppose C h r for every theorem a of 
S, (V; e) h* a ■ Th en the following is a proof of ConS in C. 

r Suppose toward a contradiction that S is inconsistent. Then S h 3u u ^ 
u. By hypothesis, therefore, (V; G) ^* 3u u ^ u. Let S be a (3u u ^ u)- 
satisfaction relation for (V; s). Then \= s 3u u ^ u, which is clearly not the 
case. Hence, S is consistent. 

Thus, Ch S is consistent . Since C is a conservative extension of S, Sh 
r S is consistent" 1 . By GodePs second incompleteness theorem, S is therefore 
inconsistent. □ 

Corollary 2.24. [S] IfS is consistent then Z.Y- r (V; e) is weakly satisfactory 1 . 

Proof. Immediate from (2.23) with (2.12). □ 

Theorem 2.25. [S] IfS is consistent then S is not finitely axiomatizable. 

Our proof is closely modeled on that of Ryll-Nardzcwski[6], but we work 
in C, rather than in ZF. Since C is a conservative extension of S, there is a 
proof in S. Since we cannot prove ConS (assuming S is consistent) we must 
specifically assume it. Note that this implies that the theory F = S + — > Infinity is 
consistent. (Every satisfactory model of S has a substructure, viz., its V u , that 
is a satisfactory model of F.) We will show that F is not finitely axiomatizable, 
from which the theorem follows. 
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Proof. Suppose toward a contradiction that 9 is a theorem of F such that {9} h F. 
Given an existential s'-formula ip = 3v <p(v, Vq, . . . , w m _i), let R^(n, n') be the 
formula 

OrdnAOrdn' AVw , . . . ,v m -i G K (3« <fi(v,vo, ■ ■ ■ ,%-i) 

->3u G K' (t>(v,v , ■ • .,u m -i)), 

and given a universal s'-formula ip =Vv <j){y, Vq, . . . , u m -i), let R^(n, n') be the 
formula 

Ordn AOrdn' A Vw , . . . , v m -i G V n (Vi> G K' <j>{v,Vo, . . . , u m -i 

->V« (j>(v,v , ■ • .,u m _i)). 

Clearly, for each such formula t/ 1 , 

FhV rd"-3 rd?^' > n R^{n t n'). 

Let i? be the conjunction of the formulas R^ for all existential and universal 
subformulas of 9. Then 

F hVord«3ord^' > Tl R(n,n). 

Let R'(n, k, /) be the s'-formula r n and k are ordinals, k > 1, and / is a function 
with domain A: such that /(0) = n and for all < I < k, f(l) is the least ordinal 
k > f(l - 1) such that R(f(l - l),fc) n . Let R"{n,k) = 3!/ R'(n,k,f). As we 
have just seen, 

FhVordn iJ"(n,2). 

It is also clear that 

FhVordnVordfe > 1 {R"{n,k)^R"{n,k+ 1)). 
Hence, by the appropriate instance of the induction schema (Foundation) of S, 

Fh Vord^Vordfc > 1 R"{n,k). 

Now let s" be the expansion of the signature s' by the addition of a single 
constant symbol N, and let 9 be the s"-theory F U { r OrdiY n } U { r iV > h n | 
n G uj}. Recall that for any x G HF, x is a canonical s'-term denoting x. Since F 
is consistent, so is 9. By the completeness theorem 2.11, there is a satisfactory 
structure G such that 6^9. 

The ordinals of © are linearly ordered, with an initial segment isomorphic to 
(a;; <). We suppose for simplicity that this segment (with its order) is actually 
(«;<). 

Let N = N e and let / be the unique element of \&\ such that 6 |= 
R'[N, N, /]. Let / be the corresponding function from the ordinals in 6 pre- 
ceding N into Ord s . 
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Let ©' be the substructure of 6 such that |6'| = {J n£uj Vf( n y By con- 
struction, 6' is an initial segment of © containing N and is a {#}-elementary 
substructure of ©. Hence, 6' |= 9, so 6' |= F, and 

©'1=3/' R'(N,N, /'). 

Let /' be the unique element of \&'\ such that 

& ^R'[N 7 N,f} 7 

and let /' be the corresponding function from the ordinals in ©' preceding N into 
Ord 6 '. Note that Dom/' = Dom/. Since 6' is a {(9}-elementary substructure 
of 6, /' = /. This contradicts the fact that / \ u is cofinal in Ord b . □ 

2.4 Inner models, elementary embeddings, etc. 

The theory of partial satisfaction outlined above provides simple and useful 
definitions of some of the more problematic notions in the metatheory of set 
theory. For example, an inner model may be defined as a transitive proper class 
M such that (M; <g) |=* ZF. 4 An elementary substructure of a p-structure & 
(which may be a proper class) may be defined as a substructure & of & with 
the property that for every p-formula 4> an d every {0}-satisfaction relation S 
for 6, the restriction of S to & is a {</>}-satisfaction relation for & . A function 
j : & — > T is elementary iff it is an isomorphism of © with an elementary 
substructure of 1. 

Given the simplicity and utility of these ideas, it is somewhat surprising that 
they have not gained greater currency in the exposition of the metathcoretical 
aspects of set theory, especially given that fact that it is standard practice to 
employ proper classes for this purpose — albeit informally as the extensions of 
formulas (in which quantification is necessarily restricted to sets, since only 
sets are actually supposed to exist). Since the definition of |=*, etc., involves 
quantification over classes, the explanation may reside in an instinctive aversion 
to such quantification, deriving from a knowledge of the paradoxes that lurk 
beyond the pale. 

Adherence to the convention that class variables arc not to be quantified is 
illustrated in [8] , which provides a formal definition of inner model by means of 
a particular conjunction a of axioms of ZFC and a formula Inn(M) such that 

1. Inn(M) is r a M and (M) is a transitive proper class" 1 , and 

2. for every theorem 6 of ZFC, ZFC h Inn(M ) ->• 9 M . 

Another approach is to define an inner model as a transitive class that is al- 
most universal and closed under Godel operations[3, p. 182]. With any of these 
approaches other ad hoc arrangements are necessary to deal with elementary 
embeddings of inner models and related notions. 

4 Note that according to this definition, it is a theorem of GB that V is an inner model of 
ZF and L is an inner model of ZFC. 
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In [5, Appendix X] Levy makes the exclusion of class quantification explicit 
in his description of the logical system P* , which extends the language C s of 
pure set theory by the addition of class variables, which cannot be quantified; 
class terms {x | $(x)}, where x is a set variable and $ is any formula; and 
axioms that define the relations of membership and equality between sets and 
class terms. The stipulation that class variables are not to be quantified allows 
for a relatively easy syntactical proof (compared to [7]) that P* is a conservative 
extension of the theory P, which is essentially the axiom of extensionality in C s . 

3 Conservative extension of set theories to finitely 
axiomatizable class theories 

Theorem 3.1. [C] For any recursively enumerable extension ofS, there is a 
finite extension 0' of C such that 0' n C s = 0. 

Note that this is the strongest possible theorem along these lines, inasmuch 
as the deductive closure of a finite theory is necessarily recursively enumerable. 
Note also that it is proved in C, which does not have Infinity. Since C is a 
conservative extension of S, if we stated the straightforward translation of the 
theorem into C 5 it would be a theorem of S. 

This should not be confused with the superficially similar results of Kleene[4] 
and Craig and Vaught[2], which produce a finitely axiomatizable conservative 
extension of a recursively enumerable p-theory (which is required to have only 
infinite models) by introducing additional predicates with axioms asserting that 
they represent the p-language and satisfaction predicate, and that all sentences 
of are true. 

To highlight the issues surrounding the existence of satisfaction relations and 
the implications for provability, we first give a proof of the theorem in ZF, i.e., 
using Infinity, and we then show how to accomplish it in C. 

Infinitary proof of Theorem 3.1. Suppose is a recursively enumerable exten- 
sion of S. Let D be an s-formula with two free variables, all of whose quantifiers 
are bounded, such that for all x G HF, i 6 6f>3i/ g HF D(x, y). 
Let 0' = CU {<?'}, where 9' = 

(3.2) r V5Vn GwViG V n (if 3y G V n D (x,y) and S is the ^-satisfaction 
relation for V, then ^ s x) n . 

9 1 says roughly that for every sentence x G 0, V \=* x, making use of a slight 
modification of the universal satisfaction predicate as given by Definition 2.10. 
Since Theorem 3.1 does not mention satisfaction, we are free to define it as we 
wish within the proof. 

Claim 3.3. W n C s D 0. 

Proof. Suppose 9 € 0. Let n e w be such that 9 S V n and there exists 
y G V n such that D(9,y). It is easy to show that Ch 9 G A(y) G 
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V n A D(9,y) n . Thus, 0' h r for all 5, if S is the ^ fi) -satisfaction relation for 
V then \= s 9 n . It follows from Theorem 2.21 that 0' h 9. D(3.3) 
Claim 3.4. B'n^ce. 

Proof. Suppose a G 0' n C s . We will use the completeness theorem to 
show that h a by showing that a holds in any satisfactory countable model of 
0. Suppose, therefore, that 971 = (M;E) is a satisfactory countable model of 
0. Like all models of S, 971 has an initial segment that is isomorphic to (HF; €), 
and in the interest of efficiency we arrange that this initial segment actually is 
(HF; e). Since we arc working in ZF, there are plenty of sets outside HF. 

We now extend 371 to a model 97t' = (M,M';E') of C by adding, for each 
subset A of M definable over 97? (from a parameter in M) that is not already the 
^-extension of a member of M, a new element whose extension is A. (These are 
the proper classes.) We will identify each X 6 M' \ M with {x G M \ x E' X}. 

This is the standard construction for the infinitary proof that C is a conser- 
vative extension of S. Since we are working in ZF, 97t' is a set, and therefore 
is satisfactory, so all references to satisfaction in 97t' may be understood in the 
usual way. It is easy to show that 971' |= C. 

Claim 3.5. M' \= 9'. 

Proof. Remember that we have arranged that HF is an initial segment 
of 9Jt and therefore of HF m . Suppose toward a contradiction that n 6 ui m , 
9,y G (V n ) m , and S G M' are such that 

(3.6) OW |= 

1. D[0,y], 

2. r \S\ is the ^^-satisfaction relation for V^, and 

3. r ^ s 9^. 

Suppose first that n is in the standard part of ur 01 . Then n G w; 9,y G V n ; and 
D{9,y); so 9 e 0. Thus, M \= 9. Also, {x G M | M' \= r x G S n } is the 
"^-satisfaction relation for 3Jt. Thus, by virtue of (3.6.3), SOT' \= -<9, contrary 
to the fact that M \= 9. 

Thus, n is in the nonstandard part of u m . Note that C V^ 11 , and it is 
straightforward to show by induction within V u that S restricted to formulas in 
V u is the satisfaction relation for 9JI, i.e., for any s- formula ip and 9Jl-assignment 
A for if), 

m' h r h |s: |#i]Vajih#]- (3.7) 

By virtue of the construction of 9JI', S is definable over 9JI from a parameter in 
M. This allows us to apply the Godel-Tarski theorem on the undefinability of 
truth, the proof of which we reprise for the present application. 
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Let 4> £ Vui and z € M be such that 4> is an s-formula with free variables 
v o, v i: v 2, and for all ip, A G M such that 971 \= ip] is an s-formula and [A] is 
an assignment of its free variables , 

an' h r h |S| MMT^ot (= ^[^,A4 

It is easy to obtain from <f> an s-formula <f)' such that for all ip, a G M such that 
9Jt |= r if) is an s-formula with free variables vo, vi n , 

OJt'h r h S zy^<m^<t>'[il>,a,z}. (3.8) 

Let ^ = -i 4>'(vq, vo, vi). Note that </>', ?/> G V^, so by virtue of (3.8) and (3.7), 

0--.9JI |= ip[ip, z] 

o97i |= ->vhM- 

This contradiction establishes the claim. D(3.5) 
Recall that we have supposed that a G 0' n C s , and that 9JT is an arbitrary 
satisfactory countable model of O. We have constructed the satisfactory struc- 
ture 971' with the same "sets" as 9Jt, and we have shown that 971' |= 0'. Hence 
M' \= a, so Tt \= a. Thus, ha, i.e., a G 0. D(3.4) 
Claims 3.3 and 3.4 together establish the theorem. □ 

Finitary proof of Theorem 3.1. The finitary 5 proof is identical to the preceding 
argument through the proof of Claim 3.3 but differs beginning with the proof 
of Claim 3.4. We restate the claim here. 

Claim 3.9. Wn£ s CO. 

Proof. Suppose a G 0' fl C s , and suppose toward a contradiction that 
0Fct, i.e., U {-.a} is consistent. Using Theorem 2.11, let 971 = (M;E) be a 
satisfactory structure such that 971 |= U {— > cr} , and let T be the satisfaction 
relation for 971. 

Like all models of S, 97T has an initial segment that is isomorphic to (HF; g). 
Since it is possible that V = HF, we do not suppose that HF is itself an initial 
segment of 971; on the contrary, we arrange that V \ |97l| is a proper class, and 
that MnM] = 0, where M x is the class of (<j>, a) such that <j> is an s-formula with 
two free variables Vo,vi; a G M; and {x | \= T <p[x,a]} is not the ^-extension of 
a member of M. 

Let Ei = {{x,((f),a}) \ ((f>,a) G Mi A h T <f>[x,a]}. Let M' = M U Mi and 
E' = EU Ei, and let 97t' = (M, M'\ £"). Tt' is the canonical expansion of 97t 
to a model of C; however, whereas in ZF we could let M' consist of definable 
subsets of M, we now let M' consist of definitions of subclasses of M. The 

5 Note that we construe 'finitary' broadly to include C. As pointed out in the remark 
following the statement of the theorem, the theorem and proof could be given in S. 
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reason, of course, is that M may be a proper class. As a consequence, distinct 
elements of M' may have the same ^'-extension. We nevertheless define 

= m '= {(x,y) G M' x M' | Vz G M{(z,x) G E' ^(z,y) G £')}. 

The equivalence classes of = sm may be proper classes, so the reduction of 9Jt' to a 
standard model of logic with identity (i.e., one for which the identity predicate is 
interpreted as the identity relation) would be slightly more involved than usual. 
It could be done, but there is no need, so we don't bother. 

Let \& be the class of c-formulas with class-quantifier depth at most 2 (count- 
ing quantifier depth in terms of alternations of existential and universal quan- 
tification). Note that we impose no restriction on set quantifiers. All axioms 
of C may be formulated as sentences in ty. Using the fact that T is the full 
satisfaction relation for 9JI, we can easily show that the ^-satisfaction relation 
exists for 9Jt' (essentially by direct definition), and we let T' be this relation. 
Note that T' D T. It is straightforward to show that for every 9 that is an 
axiom of C or an axiom of identity, ft T 9. 

We now state and prove the analog of Claim 3.5 for the present situation. 
Note that 9', as defined in (3.2), is in 

Claim 3.10. ft T ' 9'. 

PROOF. Suppose toward a contradiction that ft T 9' . By the definition of 
T', this implies that there exist S G M'\ n G w OT ; and 9, y G {V n Y° l such that 
(3.6) holds, where we may substitute ft T for 971' |=. 

As before, we first suppose n is in the standard part of w ajI . Let H be the 
standard part of HF OT , and let i : H — > HF be the (unique) isomorphism. For 
notational convenience, let x = t(x) for x G H, and extend this notation to 
assignment functions, so that A(v) = A(v) for any assignment A and variable v 
in the sense of ffl. Then n G oj; 9,y eV n ; and D(9, y); so 9 G 9. Thus, ffl \= 9. 

It is straightforward to show by induction on complexity that S agrees with 
T (the full satisfaction relation for 3Jt), i.e., [= r r h 5 <f>[ A ] n iff |= T 4>[A], i.e., 
971 (= cj>[A]. Thus, by virtue of (3.6.3), M ft 6, contrary to the fact that M ft 9. 

n is therefore in the nonstandard part of u> m . As before, it is straightforward 
to show by induction within V u that S restricted to formulas ip in the standard 
part of 9JI agrees with T, i.e., 

h T ' r h 5 ^[AroihW (3.H) 

As before, since S (actually, {x G M \ (x, S) G E'}) is definable over 3Jt, 
there exist z G M and cj>' G H such that </>' is an s-formula with free variables 
v 0: v ii v 2 — an d for all ip, a G M such that 9JI ft ip is an s-formula with free 
variables vo, vi n , 

h T ' r h S [zjr^Wl ft 4>'[tp,a,z\. (3.12) 
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Let ip = -i </>'(v , vo, vi) in the sense of Oft. Then ip G H and tp = -i </>' (v , vi , v 2 ) , 
so by virtue of (3.12) and (3.11), 

an |= v#, z] o an |= -. 0'^, i>, z] 

0-1 art |= ip[ip,z] 
oart |= -.^#,.2]. 

This contradiction establishes the claim. □(3.10) 

Recall that we have supposed that a G 6' n C s , i.e., a is an s-sentence and 
0' h er; and we are attempting to show that h a, i.e., U {-> a} is inconsistent. 
We have supposed toward a contradiction that St is a satisfactory structure 
such that 9Jt |= U { _i cr}. We have constructed 2Tt' such that 9Jt' has the 
same "sets" as St, and \= T 0' U { _i cr}, with the Vf-satisfaction relation T". To 
complete the proof we must derive a contradiction from the fact that 0' h a. 

Theorem 2.13 is not available, because we have not shown that 9Jt' is weakly 
satisfactory. It is sufficient, however, that 9UI is satisfactory. We make use of the 
methodology of the unitary proof of (2. 2), 6 which proceeds by showing how to 
transform a C-proof 7r of an s-sentence v into an S-proof tt' of v by the systematic 
elimination of class variables in favor of class constants, and the elimination 
of the latter in favor of expressions involving s-formulas essentially serving as 
definitions. In this process, for each class constant C wc define an appropriate 
s-formula <pc with one free variable, and we replace each expression r G C by 
4>c{ T )- The premises of tt arc axioms of C, each of which is replaced in tt' by 
finitely many instances of axioms of S. v is not affected by this transformation. 

If wc apply this procedure to a ©'-proof of a, we arrive at an s-proof with 
premises that are instances of S-axioms and sentences 6^ obtained from 6' by 
omitting the universal quantification of S and replacing each expression r € S 
in (3.2) (which we imagine to be written out in full) by <p(r), where <j) is an 
s-formula with one free variable. By construction, for any s-formula </> with one 
free variable, {x G M \ Tt \= cf>[x]} is {x G M |h T ' r x G S n } for some 
S G M' . Since ^= T is the ^-satisfaction relation for 9Jt', where 'J is the class 
of c- formulas with class-quantifier depth at most 2, and |= T 8', it follows that 
(= T ' 0*. Hence 9Jt |= 0*. (We could also use the fact that |= T ' C U {0'}, and 
each 0^ has a proof from C U {0'} all of whose formulas arc in 4'.) 

Thus, we have an s-proof of a from premises that are true in ft, from which 
it follows that 9Jt |= a. This contradiction establishes Claim 3.9 and with it the 
theorem. □ 

4 Universal satisfaction and forcing 

The basic construction in the theory of forcing is that of a generic extension 
M r ' G of a transitive model M of ZF by an M-generic filter G on a partial 

e We are paraphrasing somewhat Shoenfield's original finitary proof of this result in [7]. A 
proof that is directly applicable to the present situation may be found in [10, Chap. 2]. 
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order P £ M, where M P ' G is the structure that interprets each forcing term 
x £ M r as x G . M is referred to as the ground model. The usefulness of 
this construction derives from the existence of a forcing relation |h M,p with the 
following properties: 

1. For any sentence a of the forcing language C M ' r , 

1. if for every p £ |P| there is an M-generic filter G on P with p £ G, 
then for any p £ |P|, p ||- M ' P cr iff for every M-generic filter G on P, if 
p £ G then Af P ' G |= cr; and 

2. for any M-generic filter G on P, M P ' G |= a iff for some p E G, 
p\r- M ' r a. 

2. |h A/ ' P is, in a suitable sense, definable over M, i.e., over the structure 
(M;e). 

Note that as far as M is concerned, lh A/ ' P is lh v '' P , where is the class of all 
sets, so proper classes as ground models are an inescapable feature of the theory 
of forcing, with V as the paradigm. Given a partial order P, we let lh p be lh y ' P . 

When the ground model M is a proper class, the assumption that M models 
ZF cannot be formulated as M \= ZF , as the full satisfaction relation for M 
may not exist. In the context of ZF, we may implement this assumption by 
positing 8 AI for every axiom 9 of ZF (M being given by means of a defining 
formula). In the context of GB we have the option of formulating this assumption 
as M |=* ZF . This use of |=* in the context of forcing raises an issue that 
does not arise in other applications of |=* in set theory, which we will describe 
presently, and which wc will settle by means of a conservative extension result, 
Theorem 4.9, somewhat akin to Theorem 3.1. 

The issue in question arises in connection with the method of "arguing in 
the generic extension" M P ' G to prove that a sentence of the forcing language is 
forced by a condition p. Actually, one does not argue in M P ' G itself, but rather 
in a theory appropriate to it, without assuming that G actually exists, and 
uses the existence of the argument to infer the forcing relationship. Thus, this 

IP V IP 

method is applicable in particular to lh , i.e., to lh ' , even though l/-gcncric 
filters demonstrably do not exist. 

Rather than working in the forcing language £ M > P per se, we will work in a 
more conventional language, with a signature s* that extends the signature s of 
set theory by the addition of a unary predicate symbol V and constant symbols 
P and G. 

(4.1) Let 9 be the s*-theory consisting of 

1. ZF with the additional predicate symbol V; 

2. r V is transitive and contains every ordinaV, i.e., r Vx, y (V(x) A y £ 
.t^V(j/)) andVord" V(a) n ; 

3. ZF V , i.e., all axioms of ZF relativized to V; 

4. r V(P) and P is a partial order 1 ; 
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5. r G is a V -generic filter on P n ; 

6. r every set is x G for some x G V p_l . 

The following proposition is a key element of the theory of generic extensions. 

Proposition 4.2. [ZF] For any finite subset T of there is a finite subset F of 
ZF such that for any transitive (set) model M of F, partial order P G M, and 
M-generic filter G on P, Af[G] |= T with V, P, G interpreted respectively as M , 
P, and G. 

At this point, some remarks concerning the definability of the forcing relation 
arc in order. Since |h M,r subsumes the satisfaction relation for a transitive class 
M, the full forcing relation — like the full satisfaction relation for M — is not 
definable over M, and lh p is not definable in the context of ZF. Instead, we 
define, for each formula 0, the relation 

{{p,X , ■ ■ .,X n -l) \ p G |P| AX ,.. . ,X n -l G V V /\p\\- Vr <j) (x , ■ ■ ■ ,X„_l) n }. 

(4.3) 

This is, of course, a definition schema, not a single definition. In GB we have 
the option of defining a universal forcing predicate analogous to the universal 
satisfaction predicate |=*, but this is irrelevant to the present discussion, so wc 
defer this definition for now. 

The following proposition establishes the method of "arguing in a generic 
extension" . The theorem is well known, so we only briefly sketch the proof. 

Proposition 4.4. [S] Suppose ip and <j) are s-formulas with n + 2 and n free 
variables, respectively. Suppose O h 

(4.5) r for all p G |P and xq, . . . , x n -i G V p , if i/> v (P,p, xo, . . . , x n -i) then 
peG^ <j> (4,...,x^_ 1 ) n . 

Then ZFh 

(4.6) r if P is a partial order, p G |P|, xo, ■ ■ • , x„_i G V r ', and (i/))(F,p, xq, . . . , 
x n -i), then p\\- Pr 4> (xq, . . . ,x n -i)~ l ~ l - 

Proof. Let ip and cf> be given, and let Qq be a finite subset of such that 0o 
proves (4.5). Let F be a finite subset of ZF such that for any transitive model 
M of F, and any partial order P G M, 

1. M correctly defines lh M ' P 0; and 

Alternatively, we may extend ZF by the addition of a new predicate symbol r lh n , with 
axioms that correspond to the usual recursive definition of the forcing relation. Note that 
these axioms allow us to generate a definition for the relation (4.3) for any given </>, but this 
definition has quantifier depth that increases with that of <f>, and the axioms do not yield a 
definition of lh p in its entirety. Note also that, since r lh n is not introduced by definition, we 
must explicitly extend the axiom schemas of ZF to formulas that incorporate the new symbol. 
It is not hard to show that this theory is a conservative extension of ZF, so it is largely 
immaterial which approach we use to the description of forcing over V ', but in this article we 
will deal with ZF unmodified. 
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2. for any M-generic filter G on P, M[G] \= 9 with V, P, G interpreted 
respectively as M, P, and G. 

We now sketch a proof of (4.6) in ZF (without being too fussy about use vs. 
mention). We begin by supposing toward a contradiction that it is not the 
case. We use a reflection argument, followed by the transitive collapse of a 
countable elementary substructure, to obtain a countable transitive model M 
of F, with a partial order P G M, p G |P|, and Xo, . . . ,x n -i G M ¥ , such that 
M |= ^pP,p,x ,...,a;„_i], and p¥ M;p </>(x , ■ ■ ■ , x n _i). We let G be an M- 
generic filter on P such that p G G and M[G] \£ <P[x^ , ■ ■ ■ , x^_ 1 ]. Since M |= F, 
M[G] \= 6 . It follows that M[G] ^ ^[a;^, . . . , z^Lj, a contradiction. 

In effect, we justify the method of arguing in a hypothetical generic extension 
of V by arguing in an actual generic extension of a countable transitive model 
of a finite fragment of ZF. □ 

Note that implements the hypothesis that V is a model of ZF by positing 
each axiom of ZF relativized to V. In a pure set theory we have no other 
option, as ZF is not finitely axiomatizable, and proper classes do not exist. In 
GB we may use the satisfaction predicate |=* defined in (2.10) to implement 
the hypothesis that a proper class M is a model of ZF as the single sentence 
r M ZF n . 

The use of \=* can play the same simplifying role in the exposition of the 
theory of forcing as in other areas of set theory that deal with proper class 
models, but in the case of forcing, the following question arises: 

Let c* be the signature c with additional constants V, P, and G; we also 
treat V as a unary predicate in the usual way. 

(4.7) Let 9' be the c*-theory which is 9 with the following changes: 

V. GB. 

3'. r V h* ZF n . 

When "arguing in a generic extension" , we will naturally reason from 9' rather 
than 9. The question is whether Proposition 4.4 applies with 9' in place of 9. 

In the absence of an affirmative answer to this question, the usefulness of 
|=* is much diminished, as one must maintain a parallel development of forcing 
without (=* to use when deriving forcing relations by "arguing in a generic 
extension" . Thus, the following theorem is a great convenience. 

Theorem 4.8. [S] Suppose ip and <f> are s-formulas with n + 2 and n free vari- 
ables, respectively. Suppose 9' h 

r for all p G |P| and xo, ■ ■ ■ , x n -i G V p , if ip v (P,P, xo, . . . , x n -i) then p G 
G^ (^,...,4_ 1 ) n . 

Then ZFh 

r if P is a partial order, p G |P|, xq, . . . , x n -\ G V p , and (^)(P, p, xq, . . . , x„_i), 
then p\\- Fr (j> (a; , . . . , x„_i) nn . 
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Proof. This follows immediately from Theorem 4.4 and the following theorem 
(4.9). □ 



Theorem 4.9. [S] 0' is a conservative extension of in the sense that for any 
s* -sentence a, if&ha then ©her. 

Proof. We will carry out the proof in C. Since the statement of the theorem is 
an s-sentence and C is a conservative extension of S, the theorem follows from 
S. 

We begin as in the finitary proof of Theorem 3.1. Thus, suppose 0' h a and 
suppose toward a contradiction that ©Fer. Let 97t = (M; G 231 , M , P, G) be a 
satisfactory structure such that 971 |= © U {-> a}, where M = V OT , P = P m and 
G = G m . Let T be the (full) satisfaction relation for 971. Thus, \= T © U {-><r}. 
Let s v be the expansion of the signature s by the addition of the unary predicate 
symbol V (without the constant symbols P and G of s*). Extend 971 to a c*- 
structure 971' as before, by adding "proper classes" definable over 971. 

(4.10) Clearly, each added class is defined by an s v -formula from a parameter 
in M, which may incorporate P and/or G. 8 

Let \& be the class of c*-formulas with class-quantifier depth at most 2, and let 
T' be the ^-satisfaction relation for 971'. 

Claim 4.11. h T ' 

PROOF. It is straightforward to check that \= T 9 for all 9 G 0' other than 
r V |=* ZF n . To show that \= T r V |=* ZF n , suppose toward a contradiction 
that it does not. Note that V |=* ZF is for every 9 € ZF, for every {9}- 
satisfaction relation S for V, (6,0) G S , so it has class-quantifier depth 1. 
Hence |= T ' r V ^* ZF n , so there exist 9 G M and S G M' such that \= T 
r 9 G ZF n and [= T ' r S is the {|6»]}-satisfaction relation for V, and ^ S [q^_ 

At this point the proof of Theorem 3.1 bifurcated according to whether 9 is 
in the standard or the nonstandard part of 971. In the latter event we obtained 
a contradiction from the fact that S would include the full satisfaction relation 
for 971, which cannot be definable over 97t. That depended on Definition 3.2 of 9' 
in terms of ^-satisfaction relations: if n G M is nonstandard then $^ contains 
every standard s-formula. For this method (with (V; G) and 9 instead of (M; G) 
and 9') to be applicable in the present case, we would have to reformulate the 
universal satisfaction predicate so that & (=* <fi[A] iff for every ^-satisfaction 
relation S for &, (4>,A) G S, where is defined so that if </> is nonstandard 
then $0 contains every standard formula. For example, we could let $0 consist 
of all formulas with complexity not greater than that of <j) in some appropriate 
sense, rather than letting $^ consist of all subformulas of (f>, as we have done. 
In the proof of Theorem 3.1 it was legitimate to define $0 however we wished, 
as the theorem does not mention satisfaction. In the present case, such an 

8 For notational simplicity, any formula requiring n > 1 parameters is replaced by a formula 
with a single parameter, which is an n-sequence. 
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alteration would be inelegant, to say the least — and it is unnecessary, since we 
may proceed as follows. 

As before, let H be the standard part of HF OT . Note that H is also the 
standard part of HF OT ° , where 9JIq is the substructure of 9Jt corresponding to 
Mq. Let x i — y x be the isomorphism of H with HF. To simplify the notation, 
suppose that (C s ) m is C s , so e = e for any s*-expression e. 

It is easy to show (as in Theorem 2.21) that if 8 G H then \= T ' r ^ s 8 n 
iff h T <? V , so h T ' r H 5 e n > s in ce h T z|lV b Y hypothesis. Thus, 6» is in the 
nonstandard part of ZF OT , which means that it is an instance of one of the axiom 
schemas for a nonstandard formula. 

We will suppose that the schemas are Collection and Comprehension. (Foun- 
dation may be formulated in ZF as the statement that all nonempty sets have 
an G-minimal element; it need not be formulated as a schema.) A sufficiently 
general version of Collection is 

r \/y\/x3 0rd a Vz G x (3 0r d/3 *P {z, P, y) -» 3/3 < a ip(z,fi,y)), 

where ip is an s-formula with three free variables. Suppose 8 is the above instance 
of Collection. We will derive a contradiction by showing that \= T r \= s 8 n . 

Since \= T r \S} is the { \9] }-satisfaction relation for V n and |= T r ip is a 
subformula of \6 n , it suffices to show that 

h T ' r Vy , ieV 3 Ql . d a Vz g x (3 Ql . d p ^ s ip][z,P,y] 

-^3 0lti P<a h S Mz,p,y]y. 

This is an instance of the Collection schema of GB and follows from the fact that 
\= T Collection. 

The case that 8 is an instance of Comprehension is not so simple. Suppose 

9 = r Vy Vcc 3x' Vz(z6i'f>z£iA tp (z, y)) n , 

where tp is an s-formula with two free variables. Given y, x G Mq, we must show 
that there exists x' G M such that for all z G Mq, z G ot x' iff z G OT x and \= T 

By construction, S represents a subclass of M definable over CUT by an s v - 
formula <ft from a parameter in M, which is a G for some a G Mq, i.e., 

h t ' r h s muir^A) g ot ' s«h T *Aa c ]. 

Thus, given y, x G Mo, 

(4.12) we must show that there exists x' G Mq such that for all z G Mq, 
z E m x' iff z G OT x and \= T <fi[ip, A, a G ], where A is the assignment of z and 
y to the free variables of ip. 

Let u, v be new variables, and let <p' be the s v -formula with free variables 
u, v, obtained from S is the {(u) {-satisfaction relation for V by replacing each 
subformula of the form (ip, A) G S by <p(tp,A,v). Without belaboring the 
issue, suffice it to say that cp' is a conjunction of formulas such as 
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1. r u is an s*-formula n ; 

2. r for any subformulas ip and ip' of u) and V-assignment A for 0, if ip — 
-iip', then cf> (ip,A,v) iff -i (ip',A,v)~^ (with similar formulas for the 
other prepositional connectives); and 

3. r for any subformulas ip and ip' of (it), variable w, and V-assignment A for 
ip, if "0 = 3w -0', then (<p \ip,A,v) iff for some x such that V(x), {ip' , AU 
{(w, x)}, v)" 1 (with a similar formula for the universal quantifier). 

We now have 

Since T is the full satisfaction relation for 371 and \= T 0, any deduction from 
holds in T. We will therefore argue in O as follows. 
r Supposc 4>'(9, a G ) . Let p G G be such that 

ph r cP'{9,a) n . 

Claim 4.13. For every subformula ip of 9 and every V -assignment A for ip, p 
decides r 0(0>, A, a) n , i.e., either 

1. plh r 0($,A,a) n , or 

2. plh r A,a) n . 

Proof. Suppose not. Let i/j be a counterexample of minimal complexity. 
By way of illustration, suppose -0 = Bwip', and suppose A is a V-assignment 
for ip. For any a; 6 V, let A x = A U {(w,x)}, the extension of A that assigns 
a; to w. By hypothesis, for any x G V, p decides r [ (p{ip', A x , a) n . Recall that 
p forces <p'(9,a) , which says that <p defines the {(9}-satisfaction relation 
for V from the parameter oF . 

Suppose p¥ r <p(ip,A,a) n . Then for all x G V, p¥ r 0(0', A*, a) n . Thus, 
for all x G V, since p decides r <p{ip' , A x , a) n , plh r -i 4>(ip' , A x , a) n . Hence, 
plh r -.0(^,A,a) n . 

The other recursive clauses in the definition of satisfaction are handled sim- 
ilarly, and the atomic formulas are easily dealt with. D(4.f 3) 

Let x' be the set of z G x such that plh (f>(ip,A,a) , where A is the 
assignment of z and y to the free variables of ip. Then x 1 G V by virtue of 
Comprehension v . Given z G V, let A be the assignment of z and y to the 
free variables of ip. If z G a;' then p lh r <p(ip, A, a) n , so {<p){ip, A,a G ), since 
p E G. On the other hand, if z x' then pY <fi(ip,A,a) ; , so by the claim, 
p\\- r [->(f)(ij), A, a) n , whence -i A,a G ), since p G G. -1 

As noted above, the existence of this argument in O shows that there ex- 
ists x' G Mq as required by (4.12), and this completes the proof that \= T 
9. □(4.11) 

We now know that \= T 9' and \= T — i cr, where T" is the ^-satisfaction 
relation for 971', ^ being the class of c*-formulas with class-quantifier depth at 
most 2. We now wish to derive a contradiction from the assumption that 0' h a. 
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As in the proof of Theorem 3.1, if we had Infinity we could arrange that OJl' be a 
set and take X" to be the full satisfaction relation for 9Jt', from which the desired 
contradiction would follow at once. It would not be inappropriate to finish this 
way, as the theorem is only of interest in the context of forcing, which is only 
of interest in the context of Infinity; however, an argument can be made that if 
a finitary theorem has a finitary proof, one should be given, and we oblige. 

To complete the proof in C we proceed as in finitary proof of Theorem 3.1, 
showing that any proof tt of a from 0' may be replaced by a proof tt' of a from 
9. Let & = r V K ZF n , i.e., 

(4.14) r for all S, for all x G ZF, if S is an {x} -satisfaction relation for V, 
then (x, 0} G S n . 

As before, we eliminate class variables in favor of class constants, and then 
replace each expression tGC by </>c(t), where <f> is an appropriate "definition" 
of C. Each axiom of GB used as a premise in tt is replaced in ir' by finitely many 
instances of axioms of ZF. 

The premise 0' is replaced by finitely many sentences 6^ obtained from 8' by 
omitting the universal quantification of S and replacing each expression t £ S 
in (4.14) by </)(t), where <f> is a formula with one free variable v. As before, since 
each such </> defines an element of M' and \= T 9' . it follows that ^ T 6$. Hence 

Thus, wc have an s*-proof of <r from premises that are true in 9JI, so DJl \= cr, 
contradicting our assumption that SEJt (= -i cr. □ 

5 The universal forcing relation 

We conclude by giving the promised definition of the universal forcing relation 
and valuation function. We leave it to the reader to supply the definitions 
of '$ M ' P -forcing relation' and '<& M,2I -valuation function', where $ is a class 
of s -formulas. (These will cover all sentences obtained from subformulas of 
members of $ by substitution of elements of M p or M a , respectively, for their 
free variables.) 

Definition 5.1. [GB] Suppose M is a transitive model of ZF, P is a partial 
order in M, and 21 is an M-complete boolean algebra in M. 

1 . Suppose <fi is an £ M,p -sentence and p G |P| . Then p \\-* M ' ¥ § f or everv 
{</>} M,IP -forcmg relation F, pF <fi. 

2. Suppose 4> is an £ M ' a -sentence. If there exists a {0} M,a -valuation function 
F then [0]* M '* d = f F0; otherwise, [0f M ' B d = l. 9 

9 1 is the correct value for [</>]* M ' 2 ' if no {i/ij^^-valuation function exists, because in this 
case no {<^}* f,p -forcing relation exists, so {p \ plh* M,p ^>} = |P|, which corresponds to boolean 
value 1. 
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These definitions reduce to the usual ones when M is a set, and when M is 
a proper class they permit the development of the theory of forcing in the usual 
way. 

As we have noted above, this universal forcing predicate is not involved in 
any of the considerations of the preceding section. If we wished, of course, we 
could reformulate the conclusion of Theorem 4.8 to be that GBh 

r if P is a partial order, p £ |P|, xq, ■ • ■ , i n -i S V p , and (^)(P, p, xq, . . . , x n -i), 
thenph* vr cj> (x , . . . ^n-i) -1-1 , 

which would serve the same practical purpose, and would be appropriate in an 
exposition of the theory of forcing in GB using lh*. 
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